Add Authelia SSO, Jenkins OIDC, Gerrit HTTP auth, and related config

- authelia/: Full Authelia stack (docker-compose, config, setup guide, nginx snippet)
  - Forward-auth for Netdata, Cockpit, Nexus, registry
  - OIDC provider for Jenkins (oic-auth plugin, authorization_policy: one_factor)
  - HTTP header auth for Gerrit (X-Forwarded-User on /login/ only)
  - authelia_network: 172.26.0.0/16
- nginx/nginx.conf:
  - auth.swave.lol server block
  - /_authelia-auth internal subrequest locations (resolver 127.0.0.11)
  - auth_request on Gerrit /login/, Jenkins, Nexus, registry
  - OIDC finishLogin bypass for Jenkins
  - swave.lol/gerrit and swave.lol/jenkins redirect to subdomains
  - proxy_redirect for Gerrit container hostname rewrites
- nginx/docker-compose.yaml: joined authelia_network
- nginx/run_certbot.sh: added auth.swave.lol
- jenkins/docker-compose.yaml: removed --prefix=/jenkins (Jenkins now at /)
- cockpit/nginx-authelia.conf, netdata/nginx-netdata.conf: added auth_request
- git-server/gerrit.config.example: Gerrit config template (real config gitignored)
- .gitignore: added users_database.yml, gerrit.config
- CLAUDE.md: updated Jenkins, Gerrit, Authelia entries; added key files
- doc/setup-guide.md: Authelia section, updated startup order and service table

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 79 insertions, 19 deletions

diff --git a/doc/setup-guide.md b/doc/setup-guide.md
index 9a5c9d0..daa06b2 100644
--- a/doc/setup-guide.md
+++ b/doc/setup-guide.md
@@ -14,6 +14,7 @@ Full instruction to build the server from a fresh Debian installation.
   - `gerrit.swave.lol`
   - `nexus.swave.lol`
   - `registry.swave.lol`
+  - `auth.swave.lol`
 
 
 ## 1. Install Docker
@@ -581,24 +582,74 @@ docker compose restart
 
 All services should now be accessible:
 
-| URL | Service |
-|-----|---------|
-| `https://swave.lol` | Ghost (blog) |
-| `https://blog.swave.lol` | Ghost (blog, alias) |
-| `https://swave.lol/jenkins` | Jenkins (path-based) |
-| `https://jenkins.swave.lol` | Jenkins (subdomain) |
-| `https://swave.lol/cgit` | Cgit (path-based) |
-| `https://cgit.swave.lol` | Cgit (subdomain) |
-| `https://swave.lol/gerrit` | Gerrit (path-based) |
-| `https://gerrit.swave.lol` | Gerrit (subdomain) |
-| `https://swave.lol/nexus` | Nexus (path-based) |
-| `https://nexus.swave.lol` | Nexus (subdomain) |
-| `https://registry.swave.lol` | Docker Registry (via Nexus) |
-| `https://swave.lol/cockpit/` | Cockpit (server admin) |
-| `https://swave.lol/netdata/` | Netdata (metrics) |
-| `http://<server-ip>:9000` | Portainer |
-| `ssh://git@<server-ip>/repos/<repo>.git` | Git (SSH) |
-| `git://<server-ip>/<repo>.git` | Git (daemon, read-only) |
+| URL | Service | Auth |
+|-----|---------|------|
+| `https://swave.lol` | Ghost (blog) | Public |
+| `https://blog.swave.lol` | Ghost (blog, alias) | Public |
+| `https://swave.lol/jenkins` | Jenkins (path-based) | Authelia (one_factor) |
+| `https://jenkins.swave.lol` | Jenkins (subdomain) | Authelia OIDC |
+| `https://swave.lol/cgit` | Cgit (path-based) | Public |
+| `https://cgit.swave.lol` | Cgit (subdomain) | Public |
+| `https://swave.lol/gerrit` | Gerrit (path-based) | Authelia (one_factor) |
+| `https://gerrit.swave.lol` | Gerrit (subdomain) | Authelia (one_factor) |
+| `https://swave.lol/nexus` | Nexus (path-based) | Authelia (one_factor) |
+| `https://nexus.swave.lol` | Nexus (subdomain) | Authelia (one_factor) |
+| `https://registry.swave.lol` | Docker Registry (via Nexus) | Authelia (one_factor) |
+| `https://swave.lol/cockpit/` | Cockpit (server admin) | Authelia (one_factor) |
+| `https://swave.lol/netdata/` | Netdata (metrics) | Authelia (one_factor) |
+| `https://auth.swave.lol` | Authelia (SSO portal) | — |
+| `http://<server-ip>:9000` | Portainer | — |
+| `ssh://git@<server-ip>/repos/<repo>.git` | Git (SSH) | — |
+| `git://<server-ip>/<repo>.git` | Git (daemon, read-only) | — |
+
+
+## 11. Authelia (SSO)
+
+Authelia provides a unified authentication layer for protected services.
+See `authelia/setup.md` for the full step-by-step guide.
+
+Authelia must start **after** Netdata (which creates `monitoring_network`) and
+**before** Nginx.
+
+### 11.1 Quick start
+
+```bash
+# Create host directories
+mkdir -p /var/authelia/{config,data,redis,secrets}
+
+# Generate secrets (see authelia/setup.md for details)
+openssl rand -hex 64 > /var/authelia/secrets/jwt_secret
+openssl rand -hex 64 > /var/authelia/secrets/session_secret
+openssl rand -hex 64 > /var/authelia/secrets/storage_encryption_key
+openssl rand -hex 64 > /var/authelia/secrets/oidc_hmac_secret
+openssl genrsa -out /var/authelia/secrets/oidc_rsa_key.pem 4096
+chmod 600 /var/authelia/secrets/*
+
+# Copy config and create users database
+cp /root/Projects/bastion/authelia/config/configuration.yml /var/authelia/config/
+cp /root/Projects/bastion/authelia/config/users_database.yml.example \
+   /var/authelia/config/users_database.yml
+# Edit /var/authelia/config/users_database.yml — fill in real password hashes
+
+# Start Authelia
+cd /root/Projects/bastion/authelia
+docker compose up -d
+```
+
+### 11.2 Configured auth methods
+
+| Service | Auth method |
+|---------|-------------|
+| Ghost | Public (no auth) |
+| cgit | Public (no auth) |
+| Netdata | Forward-auth (Authelia) |
+| Cockpit | Forward-auth (Authelia) |
+| Gerrit | Forward-auth + HTTP header (`X-Forwarded-User`) |
+| Jenkins | OIDC (Authelia as provider) |
+| Nexus | Forward-auth (Authelia) |
+| Docker Registry | Forward-auth (Authelia) |
+
+For Gerrit HTTP header auth and Jenkins OIDC plugin setup, see `authelia/setup.md`.
 
 
 ## Network Architecture
@@ -630,6 +681,11 @@ monitoring_network (172.24.0.0/16)
 ├── netdata        (172.24.0.2)
 └── nginx
 
+authelia_network (172.26.0.0/16)
+├── authelia       (172.26.0.2, port 9091)
+├── authelia-redis (172.26.0.3, port 6379)
+└── nginx
+
 Cockpit runs natively on the host (port 9090).
 Nginx reaches it via host.docker.internal (host-gateway).
 ```
@@ -666,7 +722,10 @@ docker compose -f /root/Projects/bastion/git-server/server.yaml up -d gerrit
 # 7. Netdata (creates monitoring_network)
 docker compose -f /root/Projects/bastion/netdata/docker-compose.yaml up -d
 
-# 8. Nginx (joins all networks — must be last)
+# 8. Authelia (creates authelia_network)
+docker compose -f /root/Projects/bastion/authelia/docker-compose.yaml up -d
+
+# 9. Nginx (joins all networks — must be last)
 docker compose -f /root/Projects/bastion/nginx/docker-compose.yaml up -d
 ```
 
@@ -683,5 +742,6 @@ docker compose -f /root/Projects/bastion/nginx/docker-compose.yaml up -d
 | 9000 | Portainer (web UI) | TCP |
 | 8081 | Nexus (direct, for testing) | TCP |
 | 9090 | Cockpit (native, host only — proxied via nginx) | TCP |
+| 9091 | Authelia (internal only — proxied via nginx) | TCP |
 | 9418 | Git Server (git daemon) | TCP |
 | 50000 | Jenkins (agent communication) | TCP |